Everything you need to ship

Authentication

Passwordless OTP and magic-link sign-in via better-auth, plus optional Google/GitHub/GitLab/Bitbucket OAuth.

Admin panel

User management, impersonation, and access control at /dashboard/admin, guarded and audit-logged.

API keys

Per-user API key management. Keys are hashed (SHA-256) and plan-limited, never stored in plaintext.

Feature flags

Runtime toggles managed from the admin panel, no redeploy needed to turn a feature on or off.

Stripe billing

Checkout, customer portal, and webhook handling end-to-end. Subscriptions and one-time purchases.

Credits system

Per-call metering with atomic deduction, credit balance never goes below zero under concurrent use.

File uploads

S3-backed presigned uploads straight from the browser, plan-limited, metadata in per-user SQLite.

Per-user SQLite

Every user gets their own isolated database file. No shared schema, no row-level security to write.

Typed error handling

Every server function returns Result<T>, not a thrown exception. Errors are values you check.

Domain events

In-process typed event bus for decoupled side effects: emails, jobs, webhooks, all typed end to end.

Durable operations

Multi-step flows touching Stripe, S3, or the filesystem resume correctly if the server dies mid-operation.

Database migration path

Documented upgrade path from local SQLite to Turso, PostgreSQL, or MySQL when you outgrow it.

Notifications

In-app notification bell backed by per-user SQLite, mark-read and mark-all-read built in.

Notification preferences

Per-user granular control over which notification types they receive.

Sidebar preferences

Per-user control over which dashboard navigation items are visible.

Onboarding wizard

Multi-step flow shown to new users after signup, easy to extend with new steps.

GDPR export + deletion

Durable, crash-safe account deletion and full data export, built in from day one.

Audit log

Read-only event viewer so users can see their own account activity.

Feature requests

Shared voting board where any authenticated user can propose and upvote ideas.

Notes

Reference CRUD feature showing the full pattern: simple per-user note management.

Integrations grid

Static card grid for third-party services users can connect to.

AI chat

Full AI chat at /chat with per-user SQLite history, streaming via OpenRouter or on-device.

SEO utilities

Centralized meta tags and structured data helpers so every page is search-ready.

Blog

Static blog rendering Markdown or JSON posts via content-collections.

Lead capture

A ready endpoint and drop-in form for collecting emails before you launch.

Cookie consent

GDPR-style consent banner, toggled from the admin panel, no redeploy needed.

Email validation

Blocks disposable addresses and optionally checks MX records at signup.

Captcha

Optional Cloudflare Turnstile on public forms: login, signup, lead capture.

Background jobs

SQLite-backed queue with retries, dead-letter handling, and graceful shutdown. Survives restarts.

Transactional email

React Email components, Resend by default, SMTP/Nodemailer as a drop-in swap.

Observability

Sentry error tracking on client and server, one env var to enable.

Theming

Full look and feel lives in two CSS blocks. Swap the palette, no component edits.

UI components

shadcn/ui pre-configured and fully owned in your repo, no package to update.

E2E testing

Playwright browser tests covering full user flows, ready for local development.